Extracted

• • Target

    905300b48359955081191b071358e62de4d41f9b8a8358e26866179022d66a40.exe

  • Size

    1.0MB

  • MD5

    f20cc2c5d542b7437e9dada8b6d6378c

  • SHA1

    e417e5fa9c10838e05294ee09bba462ef0111f06

  • SHA256

    905300b48359955081191b071358e62de4d41f9b8a8358e26866179022d66a40

  • SHA512

    9b036545bc54754df16740dbbd3c5ff35f77d25bd1db90a7336ff3d5452d6e092b834470abbc2dd4f7f04e3df613fe74ae1fe5d382115df4d603cf3e7ee24f14

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QLQpioCHNIzbY/0Eutv:f3v+7/5QLZfoE0EuR

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2